—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256
===========================================================================
AUSCERT Security Bulletin
ASB-2023.0120.2
Microsoft Patch Tuesday update for Microsoft ESU for July 2023
12 July 2023
===========================================================================
AusCERT Security Bulletin Summary
———————————
Product: Windows Server
Operating System: Windows
Resolution: Patch/Upgrade
CVE Names: CVE-2023-36884 CVE-2023-36874 CVE-2023-35367
CVE-2023-35366 CVE-2023-35365 CVE-2023-35351
CVE-2023-35350 CVE-2023-35346 CVE-2023-35345
CVE-2023-35344 CVE-2023-35342 CVE-2023-35341
CVE-2023-35340 CVE-2023-35338 CVE-2023-35332
CVE-2023-35330 CVE-2023-35328 CVE-2023-35322
CVE-2023-35321 CVE-2023-35319 CVE-2023-35318
CVE-2023-35316 CVE-2023-35314 CVE-2023-35312
CVE-2023-35310 CVE-2023-35309 CVE-2023-35303
CVE-2023-35300 CVE-2023-35299 CVE-2023-35297
CVE-2023-33174 CVE-2023-33173 CVE-2023-33172
CVE-2023-33169 CVE-2023-33168 CVE-2023-33167
CVE-2023-33166 CVE-2023-33164 CVE-2023-33163
CVE-2023-33154 CVE-2023-32057 CVE-2023-32055
CVE-2023-32054 CVE-2023-32053 CVE-2023-32050
CVE-2023-32046 CVE-2023-32045 CVE-2023-32044
CVE-2023-32043 CVE-2023-32042 CVE-2023-32038
CVE-2023-32035 CVE-2023-32034 CVE-2023-32033
CVE-2023-21526
Comment: CVSS (Max): 9.8* CVE-2023-32057 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS Source: Microsoft
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* Not all CVSS available when published
Revision History: July 12 2023: CVSS information corrected
July 12 2023: Initial Release
OVERVIEW
Microsoft has released its monthly security patch update for the
month of July 2023.
This update resolves 56 vulnerabilities across the following
product(s): [1]
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
IMPACT
Microsoft has given the following details regarding these vulnerabilities.
Details Impact Severity
ADV230001 Defense in Depth None
CVE-2023-21526 Information Disclosure Important
CVE-2023-32033 Remote Code Execution Important
CVE-2023-32034 Denial of Service Important
CVE-2023-32035 Denial of Service Important
CVE-2023-32038 Remote Code Execution Important
CVE-2023-32042 Information Disclosure Important
CVE-2023-32043 Security Feature Bypass Important
CVE-2023-32044 Denial of Service Important
CVE-2023-32045 Denial of Service Important
CVE-2023-32046 Elevation of Privilege Important
CVE-2023-32050 Elevation of Privilege Important
CVE-2023-32053 Elevation of Privilege Important
CVE-2023-32054 Elevation of Privilege Important
CVE-2023-32055 Elevation of Privilege Important
CVE-2023-32057 Remote Code Execution Critical
CVE-2023-33154 Elevation of Privilege Important
CVE-2023-33163 Remote Code Execution Important
CVE-2023-33164 Denial of Service Important
CVE-2023-33166 Denial of Service Important
CVE-2023-33167 Denial of Service Important
CVE-2023-33168 Denial of Service Important
CVE-2023-33169 Denial of Service Important
CVE-2023-33172 Denial of Service Important
CVE-2023-33173 Denial of Service Important
CVE-2023-33174 Information Disclosure Important
CVE-2023-35297 Remote Code Execution Critical
CVE-2023-35299 Elevation of Privilege Important
CVE-2023-35300 Remote Code Execution Important
CVE-2023-35303 Remote Code Execution Important
CVE-2023-35309 Remote Code Execution Important
CVE-2023-35310 Remote Code Execution Important
CVE-2023-35312 Elevation of Privilege Important
CVE-2023-35314 Denial of Service Important
CVE-2023-35316 Information Disclosure Important
CVE-2023-35318 Denial of Service Important
CVE-2023-35319 Denial of Service Important
CVE-2023-35321 Denial of Service Important
CVE-2023-35322 Remote Code Execution Important
CVE-2023-35328 Elevation of Privilege Important
CVE-2023-35330 Denial of Service Important
CVE-2023-35332 Security Feature Bypass Important
CVE-2023-35338 Denial of Service Important
CVE-2023-35340 Elevation of Privilege Important
CVE-2023-35341 Information Disclosure Important
CVE-2023-35342 Elevation of Privilege Important
CVE-2023-35344 Remote Code Execution Important
CVE-2023-35345 Remote Code Execution Important
CVE-2023-35346 Remote Code Execution Important
CVE-2023-35350 Remote Code Execution Important
CVE-2023-35351 Remote Code Execution Important
CVE-2023-35365 Remote Code Execution Critical
CVE-2023-35366 Remote Code Execution Critical
CVE-2023-35367 Remote Code Execution Critical
CVE-2023-36874 Elevation of Privilege Important
CVE-2023-36884 Remote Code Execution Important
MITIGATION
Microsoft recommends updating the software with the version made
available on the Microsoft Update Catalogue for the following
Knowledge Base articles. [1].
KB5028167, KB5028222, KB5028224, KB5028226, KB5028240
REFERENCES
[1] Microsoft Security Update Guidance
https://portal.msrc.microsoft.com/en-us/security-guidance
AusCERT has made every effort to ensure that the information contained
in this document is accurate. However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation’s site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: [email protected]
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
—–BEGIN PGP SIGNATURE—–
Comment: https://auscert.org.au/gpg-key/
iQIVAwUBZK4ad8kNZI30y1K9AQgdxhAAhiPU/4BR88+PLQB3NHCVbo9+Ql1csISw
9DW5bRK9gA6rc39Q45V3tS613jIK5wUfA9I2LbS42UyzfXh+CT57IxE0j0LQpN4W
UitFdhSWhRkOwMkcIcFvJ/GRSyKZmYs+3m9DI/+l5f464B9KU+KzWncW+g1UKjJz
kXN5v/QkMaAhHip0w4o2XRtBZ+/K0TvlIx+LuFrs+jYEfjO/F/bMadMFdXbbl/fx
CtrveYt5Xsd9KDEpDmlWJfxfSLCQnvfDUy6LXGi7aEBtpXZCVA4e2oP0bPmDlq8B
YkJOozJpQq/4MrU+KvoX1yr1qkhxv/4TmfIVWd7ALhA6vxu6HJ47yU62MZBGWV+C
BC2qRwsd9Y4ke46MHFZuPjHEp1RDfBXYeMu491DIaGzcaL4DFddQUy5+5MJaS3Ox
DgMgJK6TTfWQkih7F5J+xEb2wpsfMaFXf5tWkbbljTFSjmeo8Bvz+KErQUIWKdJg
Smqip/Opo5MGZhLPqw5yfFDKNS0TEAB6yLlNUmU+Rngq5nvFhr3x1a33+PvV02lD
5DZfdRphXelD4VDYHNxUoD0KLyCfKkHIkxIDjI9Yv1XKJtjSvUab1oXZIx+q1Pve
IQfQ0h0hokcJR6t4QSudJNCINIOSFfxzP+1fBp+GiEF0Fir9U+6qjxAEW/Zhndln
qXDgqdfKi5Q=
=tHoG
—–END PGP SIGNATURE—–
Source: Read More
Security Bulletins